@neat.is/core 0.9.13-dev.20260901 → 0.9.14

package/dist/index.d.cts

@@ -183,6 +183,10 @@ interface ObservedSignal {
     callSite?: ConnectorCallSite;
     columns?: string[];
     incident?: ConnectorIncident;
+    deployState?: {
+        image?: string;
+        readyReplicas?: number;
+    };
 }
 
 /**
@@ -436,6 +440,7 @@ interface StalenessLoopOptions {
     staleEventsPath?: string;
     project?: string;
     onPolicyTrigger?: (graph: NeatGraph) => Promise<void> | void;
+    onReconcile?: (graph: NeatGraph) => Promise<void> | void;
 }
 declare function startStalenessLoop(graph: NeatGraph, options?: StalenessLoopOptions): () => void;
 declare function readErrorEvents(errorsPath: string, opts?: {

package/dist/index.d.ts

@@ -183,6 +183,10 @@ interface ObservedSignal {
     callSite?: ConnectorCallSite;
     columns?: string[];
     incident?: ConnectorIncident;
+    deployState?: {
+        image?: string;
+        readyReplicas?: number;
+    };
 }
 
 /**
@@ -436,6 +440,7 @@ interface StalenessLoopOptions {
     staleEventsPath?: string;
     project?: string;
     onPolicyTrigger?: (graph: NeatGraph) => Promise<void> | void;
+    onReconcile?: (graph: NeatGraph) => Promise<void> | void;
 }
 declare function startStalenessLoop(graph: NeatGraph, options?: StalenessLoopOptions): () => void;
 declare function readErrorEvents(errorsPath: string, opts?: {

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   routeSpanToProject,
   startDaemon
-} from "./chunk-WE3AFQYL.js";
+} from "./chunk-NV4WWJSU.js";
 import {
   ProjectNameCollisionError,
   addProject,
@@ -37,7 +37,7 @@ import {
   thresholdForEdgeType,
   touchLastSeen,
   writeAtomically
-} from "./chunk-RBZNXA5L.js";
+} from "./chunk-SSLPBQWY.js";
 import {
   startOtelGrpcReceiver
 } from "./chunk-ERE47MCR.js";

package/dist/neatd.cjs

@@ -1247,13 +1247,19 @@ function resolveOwningService(graph, nodeId) {
   }
   return null;
 }
+function isFrontierEdge(e) {
+  return e.provenance === import_types.Provenance.FRONTIER;
+}
+function rankOf(p) {
+  return p === import_types.Provenance.FRONTIER ? -1 : import_types.PROV_RANK[p];
+}
 function bestEdgeBySource(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
     const e = graph.getEdgeAttributes(id);
-    if (isFrontierNode(graph, e.source)) continue;
+    if (isFrontierNode(graph, e.source) || isFrontierEdge(e)) continue;
     const cur = best.get(e.source);
-    if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+    if (!cur || rankOf(e.provenance) > rankOf(cur.provenance)) {
       best.set(e.source, e);
     }
   }
@@ -1263,9 +1269,9 @@ function bestEdgeByTarget(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
     const e = graph.getEdgeAttributes(id);
-    if (isFrontierNode(graph, e.target)) continue;
+    if (isFrontierNode(graph, e.target) || isFrontierEdge(e)) continue;
     const cur = best.get(e.target);
-    if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+    if (!cur || rankOf(e.provenance) > rankOf(cur.provenance)) {
       best.set(e.target, e);
     }
   }
@@ -1275,7 +1281,10 @@ var PROVENANCE_CEILING = {
   OBSERVED: 1,
   INFERRED: 0.7,
   EXTRACTED: 0.5,
-  STALE: 0.3
+  STALE: 0.3,
+  // A FRONTIER surface (ADR-226) is a proposal about a cause NEAT could not observe
+  // — the least-trusted claim it makes, below STALE (which was at least once seen).
+  FRONTIER: 0.2
 };
 function volumeWeight(spanCount) {
   if (!spanCount || spanCount <= 0) return 0.5;
@@ -1510,7 +1519,7 @@ function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
   });
 }
 function isFailingCallEdge(e) {
-  return e.type === import_types.EdgeType.CALLS && (e.signal?.errorCount ?? 0) > 0;
+  return e.type === import_types.EdgeType.CALLS && !isFrontierEdge(e) && (e.signal?.errorCount ?? 0) > 0;
 }
 function callSourcesForService(graph, serviceId17) {
   const ids = [serviceId17];
@@ -1533,8 +1542,8 @@ function failingCallDominates(e, id, curEdge, curId) {
   const ec = e.signal?.errorCount ?? 0;
   const cc = curEdge.signal?.errorCount ?? 0;
   if (ec !== cc) return ec > cc;
-  if (import_types.PROV_RANK[e.provenance] !== import_types.PROV_RANK[curEdge.provenance]) {
-    return import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[curEdge.provenance];
+  if (rankOf(e.provenance) !== rankOf(curEdge.provenance)) {
+    return rankOf(e.provenance) > rankOf(curEdge.provenance);
   }
   return id < curId;
 }
@@ -1585,11 +1594,11 @@ function dominantStaleCall(graph, serviceId17, visited) {
     for (const edgeId of graph.outboundEdges(src)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type !== import_types.EdgeType.CALLS) continue;
-      if (isFrontierNode(graph, e.target)) continue;
+      if (isFrontierNode(graph, e.target) || isFrontierEdge(e)) continue;
       const owner = resolveOwningService(graph, e.target);
       if (!owner || visited.has(owner.id)) continue;
       const cur = bestByCallee.get(owner.id);
-      if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+      if (!cur || rankOf(e.provenance) > rankOf(cur.provenance)) {
         bestByCallee.set(owner.id, e);
       }
     }
@@ -1862,6 +1871,7 @@ function nodeContext(graph, nodeId, incidents, now = Date.now()) {
     for (const edgeId of graph.inboundEdges(n)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type === import_types.EdgeType.CONTAINS) continue;
+      if (isFrontierEdge(e)) continue;
       errorsFromCallers += e.signal?.errorCount ?? 0;
       inboundVolume += e.callCount ?? e.signal?.spanCount ?? 0;
       if (e.provenance === import_types.Provenance.STALE) stale = true;
@@ -1875,6 +1885,7 @@ function nodeContext(graph, nodeId, incidents, now = Date.now()) {
     for (const edgeId of graph.outboundEdges(n)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type === import_types.EdgeType.CONTAINS) continue;
+      if (isFrontierEdge(e)) continue;
       outboundVolume += e.callCount ?? e.signal?.spanCount ?? 0;
       if (e.type === import_types.EdgeType.CALLS) outboundErrors += e.signal?.errorCount ?? 0;
       if (e.provenance === import_types.Provenance.STALE) stale = true;
@@ -1908,6 +1919,11 @@ function isSaturated(ctx) {
 function isBoundaryTimeoutSymptom(ctx) {
   return ctx.errorsEmittedHere > 0 && ctx.boundaryTimeout === true && ctx.errorsFromCallers === 0 && ctx.hasOutboundDeps === true && ctx.observedErroringDownstream !== true;
 }
+var UNREACHABLE_INBOUND_ERROR_RATE = 0.5;
+var UNREACHABLE_MIN_INBOUND = 3;
+function isUnreachableSeed(ctx) {
+  return ctx.callCount >= UNREACHABLE_MIN_INBOUND && ctx.errorsFromCallers > 0 && ctx.errorsFromCallers >= UNREACHABLE_INBOUND_ERROR_RATE * ctx.callCount && ctx.errorsEmittedHere === 0 && ctx.outboundVolume === 0;
+}
 function classifyNode(ctx) {
   if (ctx.errorsEmittedHere > 0) {
     if ((ctx.stale || isSaturated(ctx)) && ctx.errorsFromCallers >= ctx.errorsEmittedHere) {
@@ -1916,6 +1932,7 @@ function classifyNode(ctx) {
     if (isBoundaryTimeoutSymptom(ctx)) return "symptom-only";
     return "primary-failure";
   }
+  if (isUnreachableSeed(ctx)) return "unreachable";
   if (ctx.errorsFromCallers > 0) return "symptom-only";
   return "unrelated";
 }
@@ -2152,22 +2169,44 @@ function routeMatches(declared, incident) {
   const b = normalizeRoute(incident);
   return a === b || a.startsWith(b) || b.startsWith(a);
 }
-function structuralUpstreamPointer(graph, boundaryNode, incidents) {
-  const route = boundaryIncidentRoute(boundaryNode, incidents);
-  const callees = declaredOutboundCallees(graph, boundaryNode);
+function firstDeclaredCallee(graph, node, route) {
+  const callees = declaredOutboundCallees(graph, node);
   if (callees.length === 0) return null;
   const narrowed = route !== void 0 ? callees.filter((c) => c.route !== void 0 && routeMatches(c.route, route)) : callees;
   const chosen = narrowed.length === 1 ? narrowed[0] : callees.length === 1 ? callees[0] : null;
-  if (!chosen) return null;
-  let node = chosen.target;
-  const seen = /* @__PURE__ */ new Set([boundaryNode, node]);
-  for (let depth = 0; depth < ROOT_CAUSE_MAX_DEPTH; depth++) {
-    const next = declaredOutboundCallees(graph, node);
-    if (next.length !== 1 || seen.has(next[0].target)) break;
-    node = next[0].target;
-    seen.add(node);
+  return chosen ? chosen.target : null;
+}
+function observedOutboundNextServices(graph, nodeId) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const n of nodeScope(graph, nodeId)) {
+    if (!graph.hasNode(n)) continue;
+    for (const edgeId of graph.outboundEdges(n)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (!DEP_EDGE_TYPES.has(e.type)) continue;
+      if (e.provenance !== import_types.Provenance.OBSERVED) continue;
+      if (e.target !== nodeId) targets.add(e.target);
+    }
+  }
+  return [...targets];
+}
+function resolveHangHop(graph, boundaryNode, incidents) {
+  const route = boundaryIncidentRoute(boundaryNode, incidents);
+  const own = firstDeclaredCallee(graph, boundaryNode, route);
+  if (own) {
+    return route !== void 0 ? { source: boundaryNode, target: own, route } : { source: boundaryNode, target: own };
+  }
+  const resolved = observedOutboundNextServices(graph, boundaryNode).map((n) => ({ source: n, target: firstDeclaredCallee(graph, n, route) })).filter((r) => r.target !== null);
+  if (resolved.length === 1) {
+    const hop = resolved[0];
+    return route !== void 0 ? { ...hop, route } : hop;
   }
-  return route !== void 0 ? { node, route } : { node };
+  return null;
+}
+function stagedHangProposal(graph, boundaryNode, incidents) {
+  const hop = resolveHangHop(graph, boundaryNode, incidents);
+  if (!hop) return null;
+  if (!graph.hasEdge((0, import_types.frontierEdgeId)(hop.source, hop.target, import_types.EdgeType.CALLS))) return null;
+  return hop.route !== void 0 ? { node: hop.target, route: hop.route } : { node: hop.target };
 }
 function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
   const legacy = tagged.result;
@@ -2202,29 +2241,39 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
       confidence: Math.min(legacy.confidence, 0.4),
       ...lastProv ? { provenance: lastProv } : {}
     });
+  } else if (seedCtx && isUnreachableSeed(seedCtx)) {
+    const name = displayNameOf(seedNode);
+    candidates.push({
+      node: seedNode,
+      classification: "unreachable",
+      reason: `${name} is unreachable: its callers' requests fail (${seedCtx.errorsFromCallers} erroring inbound calls) and it produced no telemetry of its own \u2014 no server spans, no outbound calls \u2014 so it never served. The failure is observed, but its cause is not in the trace: a startup failure, a crash before the first span, or an unschedulable / unhealthy pod. Inspect ${name}'s deploy state and logs \u2014 there is no code fault to find in the graph here.`,
+      context: seedCtx,
+      confidence: legacy.confidence,
+      provenance: import_types.Provenance.OBSERVED
+    });
   } else if (seedCtx && isBoundaryTimeoutSymptom(seedCtx)) {
-    const pointer = structuralUpstreamPointer(graph, seedNode, incidents);
     const seedName = displayNameOf(seedNode);
-    const routeNote = pointer?.route ? ` serving ${pointer.route}` : "";
-    if (pointer) {
-      const causeName = displayNameOf(pointer.node);
-      candidates.push({
-        node: pointer.node,
-        classification: "primary-failure",
-        reason: `${causeName} is the likely root cause (structural, INFERRED \u2014 not observed): the boundary ${seedName} only timed out waiting, and the actual culprit hung without exporting a span, so this is walked from the declared call graph${routeNote}, not from runtime signal. Restore instrumentation / inspect ${causeName} to confirm.`,
-        context: nodeContext(graph, pointer.node, incidents, now),
-        confidence: Math.min(legacy.confidence, PROVENANCE_CEILING.EXTRACTED),
-        provenance: import_types.Provenance.INFERRED
-      });
-    }
+    const proposal = stagedHangProposal(graph, seedNode, incidents);
+    const routeNote = proposal?.route ? ` serving ${proposal.route}` : "";
     candidates.push({
       node: seedNode,
       classification: "symptom-only",
-      reason: pointer ? `${seedName} timed out waiting on a downstream that hung and exported nothing \u2014 a boundary reporting an upstream fault, not the fault itself.` : `${seedName} timed out but nothing it can see downstream is erroring \u2014 the cause is downstream and unobserved (the culprit hung and exported no span). No single declared callee${routeNote} resolves, so no confident cause is named; inspect ${seedName}'s declared downstream.`,
+      reason: proposal ? `${seedName} timed out waiting on a downstream that hung and exported no span \u2014 a boundary reporting an upstream fault, not the fault itself. The cause is unobservable; NEAT proposes the staged FRONTIER surface below, a hypothesis to confirm, not an observed cause.` : `${seedName} timed out but nothing it can see downstream is erroring \u2014 the cause is downstream and unobserved (the culprit hung and exported no span). No FRONTIER surface${routeNote} is staged, so no cause is proposed; inspect ${seedName}'s declared downstream and restore instrumentation.`,
       context: seedCtx,
       confidence: Math.min(legacy.confidence, 0.3),
       ...lastProv ? { provenance: lastProv } : {}
     });
+    if (proposal) {
+      const causeName = displayNameOf(proposal.node);
+      candidates.push({
+        node: proposal.node,
+        classification: "primary-failure",
+        reason: `${causeName} is the proposed hang cause (FRONTIER \u2014 a hypothesis, not observed): the boundary ${seedName} only timed out waiting and the culprit hung without exporting a span, so NEAT staged a FRONTIER surface on the unobservable hop${routeNote}. It graduates to OBSERVED when ${causeName} comes back; until then, inspect it / restore instrumentation to confirm, or it is culled.`,
+        context: nodeContext(graph, proposal.node, incidents, now),
+        confidence: Math.min(legacy.confidence, PROVENANCE_CEILING.FRONTIER),
+        provenance: import_types.Provenance.FRONTIER
+      });
+    }
   } else if (staleChain) {
     const culprit = staleChain.culprit;
     const culpritName = displayNameOf(culprit);
@@ -2288,6 +2337,9 @@ function fixRecommendationForTop(top, seedNode, legacy) {
     return legacy.fixRecommendation;
   }
   const name = top.node.replace(/^service:/, "");
+  if (top.classification === "symptom-only" && top.context.boundaryTimeout === true) {
+    return `${name} timed out waiting on a downstream that hung and exported no span \u2014 the cause is unobservable from traces. Inspect the FRONTIER surface NEAT staged on the unobservable hop (see candidates); it graduates to OBSERVED when that service recovers. Restore instrumentation on that path to confirm, rather than treating ${name} as the fault.`;
+  }
   if (top.provenance === import_types.Provenance.STALE) {
     return `Live telemetry for this path has gone quiet; the last-observed topology traces the failure downstream to ${name}. Restore instrumentation (or re-run with live traces) to confirm, then inspect ${name}.`;
   }
@@ -6249,6 +6301,14 @@ function mergeColumnsAt(graph, tableNodeId, columns, provenance, confidence) {
 function mergeObservedColumns(graph, tableNodeId, columns) {
   mergeColumnsAt(graph, tableNodeId, columns, import_types8.Provenance.OBSERVED, OBSERVED_COLUMN_CONFIDENCE);
 }
+function mergeObservedDeployState(graph, serviceNodeId, state) {
+  if (!graph.hasNode(serviceNodeId)) return;
+  const attrs = {};
+  if (typeof state.image === "string" && state.image.length > 0) attrs["observedImage"] = state.image;
+  if (typeof state.readyReplicas === "number") attrs["observedReadyReplicas"] = state.readyReplicas;
+  if (Object.keys(attrs).length === 0) return;
+  graph.mergeNodeAttributes(serviceNodeId, attrs);
+}
 function ensureDatabaseNode(graph, host, engine) {
   const id = (0, import_types8.databaseId)(host);
   if (graph.hasNode(id)) return id;
@@ -6945,6 +7005,32 @@ function promoteFrontierNodes(graph, opts = {}) {
   }
   return promoted;
 }
+function stageFrontierEdge(graph, source, target, type) {
+  if (!graph.hasNode(source) || !graph.hasNode(target)) return false;
+  if (graph.hasEdge((0, import_types8.observedEdgeId)(source, target, type))) return false;
+  const key = (0, import_types8.frontierEdgeId)(source, target, type);
+  if (graph.hasEdge(key)) return false;
+  graph.addEdgeWithKey(key, source, target, {
+    id: key,
+    source,
+    target,
+    type,
+    provenance: import_types8.Provenance.FRONTIER
+  });
+  return true;
+}
+function promoteFrontierEdges(graph) {
+  const graduated = [];
+  graph.forEachEdge((edgeId, attrs) => {
+    const e = attrs;
+    if (e.provenance !== import_types8.Provenance.FRONTIER) return;
+    if (graph.hasEdge((0, import_types8.observedEdgeId)(e.source, e.target, e.type))) {
+      graduated.push(edgeId);
+    }
+  });
+  for (const edgeId of graduated) graph.dropEdge(edgeId);
+  return graduated.length;
+}
 function rewireFrontierEdges(graph, frontierId2, serviceId17) {
   const inbound = [...graph.inboundEdges(frontierId2)];
   const outbound = [...graph.outboundEdges(frontierId2)];
@@ -7050,6 +7136,7 @@ function startStalenessLoop(graph, options = {}) {
           project: options.project
         });
         if (options.onPolicyTrigger) await options.onPolicyTrigger(graph);
+        if (options.onReconcile) await options.onReconcile(graph);
       } catch (err) {
         console.error("staleness tick failed", err);
       }
@@ -16968,6 +17055,25 @@ function detectColumnDrift(node) {
   }
   return out;
 }
+var RECOMMENDATION_DEPLOY_IMAGE_MISMATCH = "The running image differs from the manifest-declared image \u2014 the rollout has not taken (the old ReplicaSet is still serving). Re-apply the deployment or investigate why the new image failed to roll out.";
+var DEPLOY_DIVERGENCE_CONFIDENCE = 0.9;
+function detectDeployDivergence(svc) {
+  const out = [];
+  if (typeof svc.declaredImage === "string" && typeof svc.observedImage === "string" && svc.declaredImage !== svc.observedImage) {
+    out.push({
+      type: "deploy-mismatch",
+      kind: "image",
+      source: svc.id,
+      target: svc.id,
+      declaredImage: svc.declaredImage,
+      observedImage: svc.observedImage,
+      confidence: DEPLOY_DIVERGENCE_CONFIDENCE,
+      reason: `Service ${svc.name} declares image ${svc.declaredImage} but its running pods report ${svc.observedImage} \u2014 the deploy has not taken (the old version is still serving), so no incident fires.`,
+      recommendation: RECOMMENDATION_DEPLOY_IMAGE_MISMATCH
+    });
+  }
+  return out;
+}
 var SYMBOL_MISMATCH_PATTERNS = [
   {
     // "'ListProductsResponse' object has no attribute 'products_list'" and kin.
@@ -17295,6 +17401,7 @@ function computeDivergences(graph, opts = {}) {
       const svc = n;
       for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
       for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
+      for (const d of detectDeployDivergence(svc)) all.push(d);
       return;
     }
     if (n.type === import_types60.NodeType.InfraNode && n.kind === "sql-table") {
@@ -17335,7 +17442,12 @@ function computeDivergences(graph, opts = {}) {
     // orders last so at equal confidence the structural and symbol divergences
     // lead, per the contract ("rank below the definitive structural and symbol
     // divergences").
-    "observed-failing": 6
+    "observed-failing": 6,
+    // Deploy mismatch (ADR-225) is a definitive structural declared-vs-observed
+    // divergence carrying high confidence (0.9), so the confidence sort already
+    // places it among the structural leaders; this slot only breaks an exact
+    // confidence tie and sits last as a stable tiebreaker.
+    "deploy-mismatch": 7
   };
   filtered.sort((a, b) => {
     if (b.confidence !== a.confidence) return b.confidence - a.confidence;
@@ -18875,6 +18987,11 @@ async function runConnectorPoll(connector, ctx, graph, resolveTarget) {
       unresolved++;
       continue;
     }
+    if (signal.deployState) {
+      ensureServiceNode(graph, resolved.serviceName, NO_ENV);
+      mergeObservedDeployState(graph, resolved.targetNodeId, signal.deployState);
+      continue;
+    }
     if (signal.incident) {
       ensureServiceNode(graph, resolved.serviceName, NO_ENV);
       if (!ctx.errorsPath || !graph.hasNode(resolved.targetNodeId)) {
@@ -23149,6 +23266,36 @@ async function buildApi(opts) {
 // src/daemon.ts
 init_otel();
 
+// src/hang-sensor.ts
+init_cjs_shims();
+var import_types101 = require("@neat.is/types");
+var RECONCILE_INCIDENT_LIMIT = 500;
+function stageHangSurfaces(graph, incidents) {
+  const boundaries = /* @__PURE__ */ new Set();
+  for (const ev of incidents) {
+    if (ev.affectedNode && graph.hasNode(ev.affectedNode)) boundaries.add(ev.affectedNode);
+  }
+  let staged = 0;
+  for (const boundary of boundaries) {
+    const ctx = nodeContext(graph, boundary, incidents);
+    if (!isBoundaryTimeoutSymptom(ctx)) continue;
+    const hop = resolveHangHop(graph, boundary, incidents);
+    if (!hop) continue;
+    if (stageFrontierEdge(graph, hop.source, hop.target, import_types101.EdgeType.CALLS)) staged++;
+  }
+  return staged;
+}
+async function reconcileFrontierSurfaces(graph, errorsPath) {
+  promoteFrontierEdges(graph);
+  let incidents = [];
+  try {
+    incidents = await readErrorEvents(errorsPath, { limit: RECONCILE_INCIDENT_LIMIT });
+  } catch {
+    incidents = [];
+  }
+  stageHangSurfaces(graph, incidents);
+}
+
 // src/connectors/kubernetes/index.ts
 init_cjs_shims();
 
@@ -23326,6 +23473,7 @@ var IMAGE_PULL_REASONS = /* @__PURE__ */ new Set(["ImagePullBackOff", "ErrImageP
 var CRASH_LOOP_REASON = "CrashLoopBackOff";
 var FIELD_SEP5 = "\0";
 var K8S_TARGET_KIND = "k8s-workload";
+var K8S_DEPLOY_STATE = "deploy-state";
 function packK8sTargetName(identity) {
   return [identity.serviceName, identity.fault].join(FIELD_SEP5);
 }
@@ -23457,18 +23605,47 @@ function mapDeploymentToSignal(deployment, pods, config) {
     }
   };
 }
+function observedDeployState(deployment, pods) {
+  const readyReplicas = typeof deployment.status?.readyReplicas === "number" ? deployment.status.readyReplicas : 0;
+  let image;
+  for (const pod of podsForDeployment(deployment, pods)) {
+    for (const cs of pod.status?.containerStatuses ?? []) {
+      if (cs.state?.running && typeof cs.image === "string" && cs.image.length > 0) {
+        image = cs.image;
+        break;
+      }
+    }
+    if (image) break;
+  }
+  return image !== void 0 ? { image, readyReplicas } : { readyReplicas };
+}
+function deployStateSignal(deployment, pods, config) {
+  const name = deployment.metadata?.name;
+  if (typeof name !== "string" || name.length === 0) return null;
+  const serviceName = serviceNameFor(deployment, config);
+  return {
+    targetKind: K8S_TARGET_KIND,
+    targetName: packK8sTargetName({ serviceName, fault: K8S_DEPLOY_STATE }),
+    callCount: 0,
+    errorCount: 0,
+    lastObservedIso: nowIso2(),
+    deployState: observedDeployState(deployment, pods)
+  };
+}
 function mapWorkloadsToSignals(deployments, pods, config) {
   const out = [];
   for (const deployment of deployments) {
-    const signal = mapDeploymentToSignal(deployment, pods, config);
-    if (signal) out.push(signal);
+    const deployState = deployStateSignal(deployment, pods, config);
+    if (deployState) out.push(deployState);
+    const incident = mapDeploymentToSignal(deployment, pods, config);
+    if (incident) out.push(incident);
   }
   return out;
 }
 
 // src/connectors/kubernetes/resolve.ts
 init_cjs_shims();
-var import_types102 = require("@neat.is/types");
+var import_types103 = require("@neat.is/types");
 var NO_ENV3 = "unknown";
 function createK8sResolveTarget(graph) {
   return (signal) => {
@@ -23479,7 +23656,7 @@ function createK8sResolveTarget(graph) {
     return {
       targetNodeId: resolveFusedServiceId(graph, serviceName, NO_ENV3),
       serviceName,
-      edgeType: import_types102.EdgeType.CALLS
+      edgeType: import_types103.EdgeType.CALLS
     };
   };
 }
@@ -23614,7 +23791,7 @@ function unroutedErrorsPath(neatHome4) {
 }
 
 // src/daemon.ts
-var import_types105 = require("@neat.is/types");
+var import_types106 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
   return import_node_path77.default.join(scanPath, "neat-out", "daemon.json");
 }
@@ -23757,7 +23934,7 @@ function spanBelongsToSingleProject(graph, project, serviceName) {
   if (!serviceName) return true;
   if (serviceNameMatchesProject(serviceName, project)) return true;
   return graph.someNode(
-    (_id, attrs) => attrs.type === import_types105.NodeType.ServiceNode && attrs.name === serviceName
+    (_id, attrs) => attrs.type === import_types106.NodeType.ServiceNode && attrs.name === serviceName
   );
 }
 async function bootstrapProject(entry2, connectors = [], neatHome4) {
@@ -23801,7 +23978,11 @@ async function bootstrapProject(entry2, connectors = [], neatHome4) {
     const stopPersist = startPersistLoop(graph, outPath, { exitOnSignal: false });
     const stopStaleness = startStalenessLoop(graph, {
       staleEventsPath: paths.staleEventsPath,
-      project: entry2.name
+      project: entry2.name,
+      // Graduate FRONTIER surfaces whose OBSERVED twin has arrived + stage surfaces
+      // for current hangs (ADR-226), each post-ingest tick — the periodic point
+      // where OBSERVED state has settled and the errors ledger is current.
+      onReconcile: (g) => reconcileFrontierSurfaces(g, paths.errorsPath)
     });
     const stopConnectors = await startConnectorPolling({
       project: entry2.name,